kraken32-at[.]com

The domain kraken32-at.com has been identified as a brand impersonation threat specifically targeting Kraken, a cryptocurrency exchange platform. This domain is currently offline, but prior activity indicates malicious intent to deceive users by mimicking legitimate Kraken services. The specific threat type is brand impersonation, a tactic commonly used to facilitate credential harvesting or fraudulent transactions. Analysis of kraken32-at.com reveals multiple technical indicators of compromise. The domain is flagged by 12 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. It was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with high-risk domains. The domain resolves to the IP address 95.85.236.107, hosted in Germany under MHost LLC, and appears on one security blocklist. Notably, the domain lacks an SSL certificate, a red flag for user security as it indicates unencrypted connections. Infrastructure analysis further reveals that the domain was taken offline, likely due to enforcement actions or abandonment by the threat actor. The current status of kraken32-at.com is offline, reducing immediate risk to users. However, the domain's historical activity and technical indicators warrant continued vigilance. Organizations and individuals are advised to block this domain at the network level and monitor for any re-emergence under similar naming conventions. Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials, and review transaction histories for unauthorized activity. Security teams should correlate logs for connections to 95.85.236.107 and the domain itself to identify potential compromise. Proactive measures, such as implementing domain-based blocking rules and educating users on recognizing brand impersonation tactics, are recommended to mitigate future risks.